{"record":{"id":"42fab06ee3b27163","repo":"cloudflare/cloudflared","slug":"error-parsing-origincert-v","errorCode":null,"errorMessage":"error parsing OriginCert: %v","messagePattern":"error parsing OriginCert: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"credentials/origin_cert.go","lineNumber":37,"sourceCode":"\tDefaultCredentialFile = \"cert.pem\"\n)\n\ntype OriginCert struct {\n\tZoneID    string `json:\"zoneID\"`\n\tAccountID string `json:\"accountID\"`\n\tAPIToken  string `json:\"apiToken\"`\n\tEndpoint  string `json:\"endpoint,omitempty\"`\n}\n\nfunc (oc *OriginCert) UnmarshalJSON(data []byte) error {\n\tvar aux struct {\n\t\tZoneID    string `json:\"zoneID\"`\n\t\tAccountID string `json:\"accountID\"`\n\t\tAPIToken  string `json:\"apiToken\"`\n\t\tEndpoint  string `json:\"endpoint,omitempty\"`\n\t}\n\tif err := json.Unmarshal(data, &aux); err != nil {\n\t\treturn fmt.Errorf(\"error parsing OriginCert: %v\", err)\n\t}\n\toc.ZoneID = aux.ZoneID\n\toc.AccountID = aux.AccountID\n\toc.APIToken = aux.APIToken\n\toc.Endpoint = strings.ToLower(aux.Endpoint)\n\treturn nil\n}\n\n// FindDefaultOriginCertPath returns the first path that contains a cert.pem file. If none of the\n// DefaultConfigSearchDirectories contains a cert.pem file, return empty string\nfunc FindDefaultOriginCertPath() string {\n\tfor _, defaultConfigDir := range config.DefaultConfigSearchDirectories() {\n\t\toriginCertPath, _ := homedir.Expand(filepath.Join(defaultConfigDir, DefaultCredentialFile))\n\t\tif ok := fileExists(originCertPath); ok {\n\t\t\treturn originCertPath\n\t\t}\n\t}\n\treturn \"\"","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/credentials/origin_cert.go#L19-L55","documentation":"OriginCert.UnmarshalJSON decodes the JSON representation of an origin certificate (zoneID, accountID, apiToken, endpoint). If the bytes are not valid JSON or don't match the expected object shape, the raw json.Unmarshal error is wrapped as \"error parsing OriginCert: %v\". This lets callers detect corrupted or wrongly-formatted origin cert data early.","triggerScenarios":"Calling json.Unmarshal/Decode on a []byte or stream that is not a JSON object matching the OriginCert fields — e.g. a PEM block's bytes that contain non-JSON payload, truncated cert files, or JSON with wrong field types (e.g. zoneID as a number).","commonSituations":"Cert files edited by hand breaking JSON syntax; credentials fetched from an endpoint returning HTML/HTML error pages instead of JSON; wrong file passed to the origin-cert flag.","solutions":["Verify the origin cert file contains valid JSON: run it through `jq .` or `python -m json.tool`","Confirm the field types match the schema (strings for zoneID, accountID, apiToken)","Re-download or re-issue the origin certificate from Cloudflare","Check that the PEM block decoded contains ARGO TUNNEL TOKEN bytes, not some other block"],"exampleFix":"// before\ncertData := readFile(\"cert.txt\") // contains garbage/truncated JSON\n// after\ncertData, err := os.ReadFile(\"cert.pem\")\nif err != nil { return err }\nif !json.Valid(certData) { return errors.New(\"origin cert file is not valid JSON\") }","handlingStrategy":"try-catch","validationCode":"data, err := os.ReadFile(certPath)\nif err != nil { return err }\nif !json.Valid(data) {\n\treturn fmt.Errorf(\"origin cert file %s is not valid JSON\", certPath)\n}","typeGuard":null,"tryCatchPattern":"cert, err := DecodeOriginCert(blocks)\nif err != nil {\n\tif strings.Contains(err.Error(), \"error parsing OriginCert\") {\n\t\treturn fmt.Errorf(\"origin cert file is corrupted or wrong format: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Never hand-edit origin cert files","Validate cert files with `jq .` before use","Re-download certs from Cloudflare if parsing fails","Ensure you pass the right file to the origin-cert flag"],"tags":["go","json","certificate","parsing"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}